Connected: An Internet Encyclopedia
RFC 1510 - A.19. KRB_CRED verification

Top: Connected: An Internet Encyclopedia
Up: Requests For Comments
Up: RFC 1510
Up: A. Pseudo-code for protocol processing
Prev: A.18. KRB_CRED generation
Next: A.20. KRB_ERROR generation

### A.19. KRB_CRED verification

            receive packet;
            if (packet.pvno != 5) then
                    either process using other protocol spec
                    or error_out(KRB_AP_ERR_BADVERSION);
            endif
            if (packet.msg-type != KRB_CRED) then
                    error_out(KRB_AP_ERR_MSG_TYPE);
            endif

            cleartext := decrypt(packet.enc-part) using negotiated key;
            if (decryption_error()) then
                    error_out(KRB_AP_ERR_BAD_INTEGRITY);
            endif
            if ((packet.r-address is present or required) and
               (packet.s-address != O/S_sender(packet)) then
                /* O/S report of sender not who claims to have sent it */
                error_out(KRB_AP_ERR_BADADDR);
            endif
            if ((packet.r-address is present) and
                (packet.r-address != local_host_address)) then
                    /* was not sent to proper place */
                    error_out(KRB_AP_ERR_BADADDR);
            endif
            if (not in_clock_skew(packet.timestamp,packet.usec)) then
                    error_out(KRB_AP_ERR_SKEW);
            endif
            if (repeated(packet.timestamp,packet.usec,packet.s-address))
                    then error_out(KRB_AP_ERR_REPEAT);
            endif
            if (packet.nonce is required or present) and
               (packet.nonce != expected-nonce) then
                    error_out(KRB_AP_ERR_MODIFIED);
            endif

            for (ticket[n] in tickets that were forwarded) do
                    save_for_later(ticket[n],key[n],principal[n],
                                   server[n],times[n],flags[n]);
            return

Next: A.20. KRB_ERROR generation

Connected: An Internet Encyclopedia
RFC 1510 - A.19. KRB_CRED verification